Overview 573 matches · 4 in Waratek scope · 0 protected · 29 exploited · 13 CISA KEV · 81 public PoC · 29 EPSS ≥ 0.5
573matches
4in Waratek scope0.7%
0protected0.0%
29exploited5.1%
13CISA KEV2.3%
81public PoC14.1%
29EPSS ≥ 0.55.1%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
1
0.2%
No exploit published
3
0.5%
Outside Waratek scope
2
0.3%
Not applicable
567
99.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
573
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 101 / year
20024
Not applicable4
High1
Medium3
not blocked4
No public exploit4
20031
Not applicable1
Medium1
not blocked1
No public exploit1
20043
Outside Waratek scope1
Not applicable2
Critical1
High2
not blocked3
Exploited1
Working exploit published2
20058
Not applicable8
High1
Medium7
not blocked8
Exploited1
Working exploit published1
No public exploit6
200613
Not applicable13
High3
Medium10
not blocked13
Exploited1
Working exploit published6
No public exploit6
200715
Not applicable15
High10
Medium5
not blocked15
Working exploit published8
No public exploit7
200815
Not applicable15
High11
Medium4
not blocked15
Exploited1
Working exploit published1
No public exploit13
200931
Not applicable31
High21
Medium9
Low1
not blocked31
Exploited3
Working exploit published16
No public exploit12
201011
Not applicable11
High4
Medium6
Low1
not blocked11
Exploited1
Working exploit published3
No public exploit7
20116
Not applicable6
High4
Medium2
not blocked6
Working exploit published1
No public exploit5
201219
Not applicable19
High13
Medium6
not blocked19
Working exploit published2
No public exploit17
201320
Not applicable20
High16
Medium4
not blocked20
Exploited1
Forecast only1
No public exploit18
201418
Not applicable18
High6
Medium12
not blocked18
Exploited4
Working exploit published3
No public exploit11
201522
Not applicable22
High15
Medium6
Low1
not blocked22
Exploited1
Working exploit published6
Forecast only1
No public exploit14
20169
Not applicable9
Critical1
High6
Medium2
not blocked9
Working exploit published2
No public exploit7
201719
Not applicable19
Critical7
High9
Medium3
not blocked19
Exploited4
Working exploit published2
No public exploit13
201832
Not applicable32
Critical3
High22
Medium7
not blocked32
Working exploit published1
No public exploit31
201934
Not applicable34
Critical4
High20
Medium10
not blocked34
Exploited1
Working exploit published3
No public exploit30
202022
No exploit published2
Not applicable20
Critical3
High15
Medium4
not blocked22
Exploited3
Proof of concept only1
No public exploit18
202127
No exploit published1
Not applicable26
Critical6
High14
Medium7
not blocked27
Exploited1
Working exploit published1
Proof of concept only1
No public exploit24
202235
Not applicable35
Critical5
High21
Medium9
not blocked35
Proof of concept only3
No public exploit32
202352
Mitigation candidate1
Not applicable51
Critical7
High33
Medium12
not blocked52
Exploited3
Working exploit published1
Proof of concept only6
Forecast only1
No public exploit41
202435
Not applicable35
Critical2
High25
Medium8
not blocked35
Exploited1
Proof of concept only4
No public exploit30
202521
Not applicable21
Critical4
High14
Medium3
not blocked21
Working exploit published1
Proof of concept only1
No public exploit19
2026101
Outside Waratek scope1
Not applicable100
Critical7
High73
Medium20
Low1
not blocked101
Exploited2
Proof of concept only3
No public exploit96
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-23952 | High | 2026-01-22 | Not applicable | Proof of concept only | ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2. |
| CVE-2025-66631 | High | 2025-12-09 | Not applicable | No public exploit | CSLA .NET is a framework designed for the development of reusable, object-oriented business layers for applications. Versions 5.5.4 and below allow the use of WcfProxy. WcfProxy uses the now-obsolete NetDataContractSerializer (NDCS) and is vulnerable to remote code execution during deserialization. This vulnerability is fixed in version 6.0.0. To workaround this issue, remove the WcfProxy in data portal configurations. |
| CVE-2025-55315 | Critical | 2025-10-14 | Not applicable | Working exploit published | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network. |
| CVE-2025-55248 | Medium | 2025-10-14 | Not applicable | No public exploit | Inadequate encryption strength in .NET, .NET Framework, Visual Studio allows an authorized attacker to disclose information over a network. |
| CVE-2025-55247 | High | 2025-10-14 | Not applicable | No public exploit | Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
| CVE-2025-6811 | Critical | 2025-07-07 | Not applicable | No public exploit | Mescius ActiveReports.NET TypeResolutionService Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mescius ActiveReports.NET. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the TypeResolutionService class. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25397. |
| CVE-2025-6810 | Critical | 2025-07-07 | Not applicable | No public exploit | Mescius ActiveReports.NET ReadValue Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mescius ActiveReports.NET. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the implementation of the ReadValue method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-25246. |
| CVE-2025-49015 | Medium | 2025-06-18 | Not applicable | No public exploit | The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default. |
| CVE-2025-30399 | High | 2025-06-13 | Not applicable | No public exploit | Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network. |
| CVE-2025-27997 | High | 2025-05-21 | Not applicable | No public exploit | An issue in Blizzard Battle.net v2.40.0.15267 allows attackers to escalate privileges via placing a crafted shell script or executable into the C:\ProgramData directory. |
| CVE-2025-3600 | High | 2025-05-14 | Not applicable | No public exploit | In Progress® Telerik® UI for AJAX, versions 2011.2.712 to 2025.1.218, an unsafe reflection vulnerability exists that may lead to an unhandled exception resulting in a crash of the hosting process and denial of service. |
| CVE-2025-26646 | High | 2025-05-13 | Not applicable | No public exploit | External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network. |
| CVE-2025-33072 | High | 2025-05-08 | Not applicable | No public exploit | Improper access control in Azure allows an unauthorized attacker to disclose information over a network. |
| CVE-2025-26682 | High | 2025-04-08 | Not applicable | No public exploit | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
| CVE-2025-29980 | Critical | 2025-03-20 | Not applicable | Proof of concept only | A SQL injection issue has been discovered in eTRAKiT.net release 3.2.1.77. Due to improper input validation, a remote unauthenticated attacker can run arbitrary commands as the current MS SQL server account. It is recommended that the CRM feature is turned off while on eTRAKiT.net release 3.2.1.77. eTRAKiT.Net is no longer supported, and users are recommended to migrate to the latest version of CentralSquare Community Development. |
| CVE-2025-24070 | High | 2025-03-11 | Not applicable | No public exploit | Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network. |
| CVE-2024-42513 | Medium | 2025-02-10 | Not applicable | No public exploit | Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when using HTTPS endpoints. |
| CVE-2024-42512 | High | 2025-02-10 | Not applicable | No public exploit | Vulnerability in the OPC UA .NET Standard Stack before 1.5.374.158 allows an unauthorized attacker to bypass application authentication when the deprecated Basic128Rsa15 security policy is enabled. |
| CVE-2025-21176 | High | 2025-01-14 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
| CVE-2025-21173 | High | 2025-01-14 | Not applicable | No public exploit | .NET Elevation of Privilege Vulnerability |
| CVE-2025-21172 | High | 2025-01-14 | Not applicable | No public exploit | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2025-21171 | High | 2025-01-14 | Not applicable | No public exploit | .NET Remote Code Execution Vulnerability |
| CVE-2024-43499 | High | 2024-11-12 | Not applicable | No public exploit | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2024-43498 | Critical | 2024-11-12 | Not applicable | No public exploit | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2024-43383 | High | 2024-10-31 | Not applicable | No public exploit | Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta00005 through 4.8.0-beta00016. An attacker that can intercept traffic between a replication client and server, or control the target replication node URL, can provide a specially-crafted JSON response that is deserialized as an attacker-provided exception type. This can result in remote code execution or other potential unauthorized access. Users are recommended to upgrade to version 4.8.0-beta00017, which fixes the issue. |
| CVE-2024-49620 | High | 2024-10-20 | Not applicable | No public exploit | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mrcheck116 FERMA.ru.net ferma-ru-net-checkout allows Blind SQL Injection.This issue affects FERMA.ru.net: from n/a through <= 1.3.3. |
| CVE-2024-43485 | High | 2024-10-08 | Not applicable | No public exploit | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2024-43484 | High | 2024-10-08 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
| CVE-2024-43483 | High | 2024-10-08 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
| CVE-2024-38229 | High | 2024-10-08 | Not applicable | No public exploit | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2024-38168 | High | 2024-08-13 | Not applicable | No public exploit | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2024-38167 | Medium | 2024-08-13 | Not applicable | No public exploit | .NET and Visual Studio Information Disclosure Vulnerability |
| CVE-2024-7323 | Medium | 2024-08-02 | Not applicable | No public exploit | Digiwin EasyFlow .NET lacks proper access control for specific functionality, and the functionality do not adequately filter user input. A remote attacker with regular privilege can exploit this vulnerability to download arbitrary files from the remote server . |
| CVE-2024-38095 | High | 2024-07-09 | Not applicable | No public exploit | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2024-38081 | High | 2024-07-09 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2024-35264 | High | 2024-07-09 | Not applicable | No public exploit | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2024-30105 | High | 2024-07-09 | Not applicable | No public exploit | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2024-30046 | Medium | 2024-05-14 | Not applicable | No public exploit | Visual Studio Denial of Service Vulnerability |
| CVE-2024-30045 | Medium | 2024-05-14 | Not applicable | No public exploit | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-27321 | High | 2024-05-07 | Not applicable | No public exploit | OPC Foundation UA .NET Standard ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of OPC UA ConditionRefresh requests. By sending a large number of requests, an attacker can consume all available resources on the server. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-20505. |
| CVE-2024-28917 | Medium | 2024-04-09 | Not applicable | No public exploit | Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege Vulnerability |
| CVE-2024-21409 | High | 2024-04-09 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
| CVE-2024-29059 | High | 2024-03-23 | Not applicable | Exploited | .NET Framework Information Disclosure Vulnerability |
| CVE-2023-36483 | Medium | 2024-03-16 | Not applicable | Proof of concept only | Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and MASmobile Classic iOS version 1.7.24 and earlier which allows remote attackers to retrieve sensitive data including customer data, security system status, and event history. |
| CVE-2024-26190 | High | 2024-03-12 | Not applicable | No public exploit | Microsoft QUIC Denial of Service Vulnerability |
| CVE-2024-21392 | High | 2024-03-12 | Not applicable | Proof of concept only | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2024-26470 | High | 2024-02-29 | Not applicable | No public exploit | A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackers to leak the password reset token via a crafted request. |
| CVE-2024-21404 | High | 2024-02-13 | Not applicable | Proof of concept only | .NET Denial of Service Vulnerability |
| CVE-2024-21386 | High | 2024-02-13 | Not applicable | No public exploit | .NET Denial of Service Vulnerability |
| CVE-2024-23838 | High | 2024-01-30 | Not applicable | No public exploit | TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to unexpected resources on local networks or to the internet could be made which could lead to information disclosure. The issue can be mitigated by having strict egress rules limiting the destinations to which requests can be made, and applying strict validation to any user input passed to the `truelayer-dotnet` library. Versions of TrueLayer.Client `v1.6.0` and later are not affected. |
| CVE-2024-21319 | Medium | 2024-01-09 | Not applicable | No public exploit | Microsoft Identity Denial of service vulnerability |
| CVE-2024-21312 | High | 2024-01-09 | Not applicable | No public exploit | .NET Framework Denial of Service Vulnerability |
| CVE-2024-20672 | High | 2024-01-09 | Not applicable | No public exploit | .NET Denial of Service Vulnerability |
| CVE-2024-0057 | Critical | 2024-01-09 | Not applicable | No public exploit | NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability |
| CVE-2024-0056 | High | 2024-01-09 | Not applicable | No public exploit | Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability |
| CVE-2024-21907 | High | 2024-01-03 | Not applicable | Proof of concept only | Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition. |
| CVE-2023-51652 | Medium | 2024-01-02 | Not applicable | No public exploit | OWASP AntiSamy .NET is a library for performing cleansing of HTML coming from untrusted sources. Prior to version 1.2.0, there is a potential for a mutation cross-site scripting (mXSS) vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. To be subject to this vulnerability the `preserveComments` directive must be enabled in your policy file and also allow for certain tags at the same time. As a result, certain crafty inputs can result in elements in comment tags being interpreted as executable when using AntiSamy's sanitized output. This is patched in OWASP AntiSamy .NET 1.2.0 and later. See important remediation details in the reference given below. As a workaround, manually edit the AntiSamy policy file (e.g., antisamy.xml) by deleting the `preserveComments` directive or setting its value to `false`, if present. Also it would be useful to make AntiSamy remove the `noscript` tag by adding a line described in the GitHub Security Advisory to the tag definitions under the `<tagrules>` node, or deleting it entirely if present. As the previously mentioned policy settings are preconditions for the mXSS attack to work, changing them as recommended should be sufficient to protect you against this vulnerability when using a vulnerable version of this library. However, the existing bug would still be present in AntiSamy or its parser dependency (HtmlAgilityPack). The safety of this workaround relies on configurations that may change in the future and don't address the root cause of the vulnerability. As such, it is strongly recommended to upgrade to a fixed version of AntiSamy. |
| CVE-2023-48003 | Medium | 2023-12-26 | Not applicable | No public exploit | An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redirect targeted victims to any URL via the '<meta http-equiv="refresh"' in the WebSocket messages. |
| CVE-2023-31048 | Medium | 2023-12-12 | Not applicable | No public exploit | The OPC UA .NET Standard Reference Server before 1.4.371.86. places sensitive information into an error message that may be seen remotely. |
| CVE-2023-49289 | Medium | 2023-12-05 | Not applicable | No public exploit | Ajax.NET Professional (AjaxPro) is an AJAX framework for Microsoft ASP.NET which will create proxy JavaScript classes that are used on client-side to invoke methods on the web server. Affected versions of this package are vulnerable cross site scripting attacks. Releases before version 21.12.22.1 are affected. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
| CVE-2021-22143 | Medium | 2023-11-22 | Not applicable | No public exploit | The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application error it is possible the headers will not be sanitized before being sent. |
| CVE-2023-36560 | High | 2023-11-14 | Not applicable | No public exploit | ASP.NET Security Feature Bypass Vulnerability |
| CVE-2023-36558 | Medium | 2023-11-14 | Not applicable | Proof of concept only | ASP.NET Core Security Feature Bypass Vulnerability |
| CVE-2023-36049 | Critical | 2023-11-14 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-36038 | High | 2023-11-14 | Not applicable | Proof of concept only | ASP.NET Core Denial of Service Vulnerability |
| CVE-2023-44487 | High | 2023-10-10 | Mitigation candidate | Exploited | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. |
| CVE-2023-38171 | High | 2023-10-10 | Not applicable | Forecast only | Microsoft QUIC Denial of Service Vulnerability |
| CVE-2023-36435 | High | 2023-10-10 | Not applicable | No public exploit | Microsoft QUIC Denial of Service Vulnerability |
| CVE-2023-36799 | Medium | 2023-09-12 | Not applicable | No public exploit | .NET Core and Visual Studio Denial of Service Vulnerability |
| CVE-2023-36796 | High | 2023-09-12 | Not applicable | No public exploit | Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-36794 | High | 2023-09-12 | Not applicable | No public exploit | Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-36793 | High | 2023-09-12 | Not applicable | No public exploit | Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-36792 | High | 2023-09-12 | Not applicable | No public exploit | Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-36788 | High | 2023-09-12 | Not applicable | No public exploit | .NET Framework Remote Code Execution Vulnerability |
| CVE-2023-38180 | High | 2023-08-08 | Not applicable | Exploited | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2023-38178 | High | 2023-08-08 | Not applicable | No public exploit | .NET Core and Visual Studio Denial of Service Vulnerability |
| CVE-2023-36899 | High | 2023-08-08 | Not applicable | Exploited | ASP.NET Elevation of Privilege Vulnerability |
| CVE-2023-36873 | High | 2023-08-08 | Not applicable | Proof of concept only | .NET Framework Spoofing Vulnerability |
| CVE-2023-35391 | High | 2023-08-08 | Not applicable | No public exploit | ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability |
| CVE-2023-35390 | High | 2023-08-08 | Not applicable | No public exploit | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-33170 | High | 2023-07-11 | Not applicable | No public exploit | ASP.NET and Visual Studio Security Feature Bypass Vulnerability |
| CVE-2023-33127 | High | 2023-07-11 | Not applicable | No public exploit | .NET and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-37288 | High | 2023-07-10 | Not applicable | No public exploit | SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files. |
| CVE-2023-37287 | Critical | 2023-07-10 | Not applicable | No public exploit | SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system with regular user privilege to read application data, and execute submission and approval processes. |
| CVE-2023-37286 | Critical | 2023-07-10 | Not applicable | No public exploit | SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service. |
| CVE-2023-33404 | Critical | 2023-06-26 | Not applicable | Proof of concept only | An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code. |
| CVE-2023-33405 | Medium | 2023-06-21 | Not applicable | Working exploit published | Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect. |
| CVE-2023-33135 | High | 2023-06-14 | Not applicable | No public exploit | .NET and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-33128 | High | 2023-06-14 | Not applicable | No public exploit | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-33126 | High | 2023-06-14 | Not applicable | No public exploit | .NET and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-32032 | Medium | 2023-06-14 | Not applicable | Proof of concept only | .NET and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-32030 | High | 2023-06-14 | Not applicable | Proof of concept only | .NET and Visual Studio Denial of Service Vulnerability |
| CVE-2023-29331 | High | 2023-06-14 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability |
| CVE-2023-29326 | High | 2023-06-14 | Not applicable | No public exploit | .NET Framework Remote Code Execution Vulnerability |
| CVE-2023-24936 | High | 2023-06-14 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
| CVE-2023-24897 | High | 2023-06-14 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-24895 | High | 2023-06-14 | Not applicable | No public exploit | .NET, .NET Framework, and Visual Studio Remote Code Execution Vulnerability |
| CVE-2023-28260 | High | 2023-04-11 | Not applicable | No public exploit | .NET DLL Hijacking Remote Code Execution Vulnerability |
| CVE-2023-22858 | Medium | 2023-03-06 | Not applicable | No public exploit | An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs. |
| CVE-2023-22857 | High | 2023-03-06 | Not applicable | No public exploit | A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an injection of a malicious payload into a blog post. |